Oracle E-Business Tax CVE-2026-60972

Exploitation requires network HTTP access to the Oracle E-Business Suite application tier and a valid low-privileged EBS user account (CVSS PR:L - authenticated), targeting the E-Business Tax 'Internal Operations' component on versions 12.2.3 through 12.2.15. No user interaction is required (UI:N) and attack complexity is low (AC:L), so once an attacker holds any low-privilege credential the exploitation path is direct. What limits exploitation: the attacker must first obtain valid authentication (this is not an unauthenticated internet drive-by despite the 'Authentication Bypass' tag, which the PR:L vector contradicts and should be verified), must be able to reach the EBS HTTP endpoints (often internal-only in well-segmented deployments), and the target must be running an affected 12.2.x release.

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N, score 8.1) indicates a genuinely serious, low-complexity, network-reachable issue requiring only low privileges and no user interaction, with high confidentiality and integrity impact but no availability impact. This is a real prioritization concern for any organization running EBS 12.2, because valid low-privilege EBS accounts are common in large deployments and the barrier to exploitation is minimal once authenticated. However, several escalation signals are absent: there is no CISA KEV listing (not confirmed actively exploited), no public exploit code was identified, and no EPSS score was provided in the input, so probabilistic exploitation likelihood cannot be quantified. The 'Authentication Bypass' tag partially conflicts with the PR:L vector, which requires some level of authentication - this should be verified against Oracle's advisory, as it may describe a privilege/authorization bypass rather than a full unauthenticated bypass. Net: high-value target, low exploitation complexity, but no evidence of exploitation in the wild yet - patch promptly but not a confirmed emergency.

An attacker who holds or phishes a low-privilege Oracle EBS user account authenticates to the application over HTTP and sends crafted requests to the E-Business Tax Internal Operations functionality, bypassing intended authorization checks to read and alter tax data outside their assigned scope. Using this access they could exfiltrate sensitive financial/tax records or tamper with tax configuration and critical data across all E-Business Tax accessible data. No public proof-of-concept exploit has been identified at time of analysis, and low attack complexity means a working request sequence would be straightforward for a knowledgeable insider or credential-holding attacker.